CLAIMS 

1 . An error tolerant computer controlled system 

comprising 

a plurality of redundant data sources generating 
at least partially redundant data items, 

a plurality of data receivers for receiving the 
redundant data items and combining them to an error tolerant 
data item, 

a switching assembly with a plurality of inputs 
and outputs, wherein each input is connected to one data 
source or to one output and wherein each output is connected 
to one input or to one data receiver, and wherein each data 
receiver is connected via separate receiver communication 
links to at least two outputs, 

wherein said switching assembly is adapted to 
connect any of said data sources to each of said data 
receivers over at least two different receiver communication 
links, and wherein said computer controlled system is adapted 
to send every data item from any given data source to any 
given data receiver through every one of the at least two 
different receiver communication links such that the given 
data receiver receives the same data item through at least 
two receiver communication links. 

2 . The system of claim 1 wherein each receiver 
communication link connects exactly one output to exactly 
one receiver . 

3 . The system of claim 1 wherein the number of 
receiver communication links for each data receiver is 
smaller than the number of data sources, 

4. The system of claim 3 wherein the number of 
receiver communication links for each data receiver is 2 ; 
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5. The system of claim 1 wherein the switching 
assembly is divided into a plurality of switching units, 
wherein each input of each switching unit is either connected 
to one data source or via a switch communication link to one 
output of another switching unit, wherein each switching unit 
is connected via at least two switch communication links to 
other switching units, wherein each switch communication link 
connects one output to one input, and wherein each data 
receiver is connected via the receiver communication links to 
at least two different switching units. 

6. The system of claim 5 wherein, for each 
switching unit, each output can be connected to each input. 

7 . The system of claim 5 wherein exactly two 
switch communication links are attached to the inputs of each 
switching unit and/or wherein exactly two switch 
communication links are attached to the outputs of each 
switching unit. 

8. The system of claim 5 wherein the number of 
switching units corresponds to the niimber of data sources and 
wherein each switching unit is attributed to one data source, 
and wherein one input of each switching unit is connected to 
its attributed data source. 

9. The system of claim 8 wherein one output of 
the switching unit is connected to its attributed data 
source . 

10. The system of claim 1 wherein repetitive time 
windows are attributed to each data source and wherein, in 
each time window, the switching assembly connects all 
receiver communication links to the data source attributed to 
the time window while disconnecting the remaining data 
sources from the receiver communication links. 

11. The system of claim 10 wherein the switching 
assembly is divided into a plurality of switching units. 
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wherein each input of each switching unit is either connected 
to one data source or via a switch cominTinication link to one 
output of another switching unit, wherein each switching unit 
is connected via at least two switch communication links to 
other switching units, wherein each switch communication link 
connects one output to one input, and wherein each data 
receiver is connected via the receiver communication links to 
at least two different switching xinits, and wherein, in each 
time window, the switching assembly is adapted to connect all 
switch communication links to the data source attributed to 
the time window while disconnecting the remaining data 
sources from the switch communication links. 

12. The system of claim 10 wherein at least part 
of the data items carries a time stamp and wherein each 
switching unit comprises a clock synchronized by the time 
stamps . 

13 . The system of claim 12 wherein each switching 
unit is adapted to combine a plurality of received data items 
carrying time stamps in order to determine a time base. 

14. The system of claim 12 wherein each switching 
unit is adapted to combine a plurality of received data items 
carrying time stamps in order to determine a time base by 
deteirmining a median of the time steimps of data items from 
different data sources 

15. The system of claim 1 wherein a unique key is 
attributed to each data source and each data source is 
adapted to generate a digital signature for each data item it 
sends using its unique key, and wherein the data receivers 
are adapted to check a validity of the signature upon receipt 
of a data item. 

16. The system of claim 1 wherein said data 
receiver is adapted to check a validity of each of the 
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received data items and to use only those data items of a 
group of redundant data items that are valid. 

17. The system of claim 16 wherein said data 
receiver is adapted to determine a median or majority value 
of the valid data items of the group of redundant data items. 

18- The system of claim 1 wherein said data 
receivers comprise actuators. 

19. The system of claim 1 further coir^rising 
feedback links for transmitting data from said data receivers 
to said switching assembly. 

20. A vehicle comprising the system of claim 1, 
wherein said data receivers control a drive and steering 
mechanism of the vehicle. 

21. An aircraft comprising the system of claim 1. 

22. The aircraft of claim 21 comprising at least 
one pivotal drive unit for attitude control and for 
generating lift and forward thrust, and a drive control unit 
for controlling a tilt angle and a thrust of said drive unit, 
wherein said control unit is controlled by one of said data 
receivers . 

23. The aircraft of claim 22 wherein said drive 
unit is driven by an electrical motor. 

24. An error tolerant computer controlled system 

comprising 

a plurality of redundant data sources generating 
at least partially redundant data items, 

a plurality of data receivers for receiving the 
redundant data items and combining them to an error tolerant 
data item, 

a switching assembly with a plurality of inputs 
and outputs, wherein each input is connected to one data 
source or to one output and wherein each output is connected 
to one input or to one data receiver, and 
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a plurality of receiver conmiunication links, 
wherein each data receiver is connected via separate receiver 
communication links to at least two outputs and wherein the 
number of receiver communication links for each data receiver 
is smaller than the number of data sources 

wherein said switching assembly is adapted to 
connect any of said data sources to each of said data 
receivers over at least two different receiver communication 
links, and wherein said computer controlled system is adapted 
to send every data item from any given data source to any 
given data receiver through every one of the at least two 
different receiver communication links such that the given 
data receiver receives the same data item through at least 
two receiver communication links. 

25. An error tolerant computer controlled system 

comprising 

a plurality of redundant data sources generating 
at least partially redundant data items, 

a plurality of data receivers for receiving the 
redundant data items and combining them to an error tolerant 
data item, 

a switching assembly comprising a plurality of 
switching units, each switching unit having a plurality of 
inputs and a plurality of outputs, wherein each input of each 
switching unit is either connected to one data source or via 
a switch communication link to one output of another 
switching unit, wherein each switching unit is connected via 
at least two switch communication links to other switching 
units, wherein each switch communication link connects one 
output to one input, and wherein, each data receiver is 
connected via receiver communication links to at least two 
different switching units. 
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wherein said switching assembly is adapted to 
connect any of said data sources to each of said data 
receivers over at least two different receiver communication 
links, and wherein said computer controlled system is adapted 
to send every data item from any given data source to any 
given data receiver through every one of the at least two 
different receiver communication links such that the given 
data receiver receives the same data item through at least 
two receiver communication links. 

26. The error tolerant computer controlled system 
of claim 25 wherein, for each switching unit, each output can 
be connected to each input. 

27. An error tolerant computer controlled system 

comprising 

a plurality of redundant data sources generating 
at least partially redundant data items, 

a plurality of data receivers for receiving the 
redundant data items and combining them to an error tolerant 
data item, 

a switching assembly with a plurality of inputs 
and outputs, wherein each input is connected to one data 
source or to one output and wherein each output is connected 
to one input or to one data receiver, and wherein each data 
receiver is connected via separate receiver communication 
links to at least two outputs, 

wherein said switching assembly is adapted to 
connect any of said data sources to each of said data 
receivers over at least two different receiver communication 
links, and wherein said computer controlled system is adapted 
to send every data item from any given data source to any 
given data receiver through every one of the at least two 
different receiver communication links such that the given 
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data receiver receives the same data item through at least 
two receiver communication links, and 

wherein repetitive time windows are attributed to 
each data source and wherein, in each time window, the 
switching assembly connects all receiver communication links 
to the data source attributed to the time window while 
disconnecting the remaining data sources from the receiver 
communication links. 
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